I have a Splunk Enterprise cluster that consists of:
My doubt is: when the Enterprise license expires and you don't include a new license, what happens to the data already residing in the indexers? Does it remain accessible? Is there any specific procedure that I would need to perform to make sure the data would remain accessible in that situation?
As I understand it, Splunk lets you to downgrade to a Free license, and then you lose all the Enterprise features, including distributed search. Given that Free license doesn't allow distributed search, does this mean that the 3 indexers will automatically become standalone instances, and I'd still be able to search their data individually?
When your license expires, you continue to ingest data and it continues to be maintained as always, but you can no longer search it. In the case of downgraded to Free and losing distributed, yes: each indexer becomes a standalone unit and whatever gets forwarded to any indexer is searchable on that indexer, provided it also is setup to use the Free license.
Just to make sure I understand:
If I make sure that (1) data stops coming into the indexers before the license expires, and (2) the license is downgraded to Free in the license master, do the indexers automatically become standalone and individually searchable?
A follow up question about the described scenario:
After license expiration, when downgrading the cluster members from Enterprise to Free, is there any special procedure that needs to be performed to make sure that the already existing data (everything that was indexed prior to the expiration) is preserved?